{
 "finding_id": "DF-3080",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "Unprivileged users can address kernel-internal proc0 (swapper) through /proc/0: atopid(0) returns 0 which slips past the NO_PID guard (vnops.c:798-800) and pfs_pfind(0) special-cases pid 0 to &proc0 (subr.c:285-287). Reproduced as uid 1001: /proc/0/{status,cmdline,rlimit} readable (status shows the swapper row incl. root group list and boot epoch), /proc/0 listed by readdir since proc0 sits on allproc. mem/ctl/regs/map/etype correctly denied. Leaked fields are individually public elsewhere (kern.boottime, kern.cp_time), so the practical delta is negligible \u2014 Info-grade namespace/hygiene defect and latent hazard; Linux/FreeBSD never expose pid 0.",
 "exploit_chain": "",
 "evidence": [
  "run.log: /proc/0 directory listing, swapper status row swapper 0 0 0 0 -1,-1 sldr ... 0 0 0,0 -, rlimit lines, 0 present in readdir listing, /proc/0/mem Permission denied (gates hold)"
 ],
 "kernel_refs": [
  "sys/vfs/procfs/procfs_vnops.c:798",
  "sys/vfs/procfs/procfs_vnops.c:809",
  "sys/vfs/procfs/procfs_subr.c:285"
 ],
 "poc_changes": "Written fresh; no seed existed.",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 1,
 "guest_dirty": 0,
 "build_cmd": "(shell script, no compile)",
 "run_cmd": "sh procfs_zero.sh",
 "code_hash": "91eef31d1432b6e40dc5b0959480a7e273578fd2aaed3197e11eff17407f68f2",
 "notes": "security.ps_showallprocs=1 on guest (default). With ps_showallprocs=0 the uid gate at vnops.c:809-811 hides /proc/0 from non-root.",
 "recommended_fix": "Reject pid 0 in procfs_lookups Proot case (pid == NO_PID || pid == 0) and skip p_pid==0 rows in procfs_readdir_root_callback.",
 "fix_status": "not_testable",
 "fix_kernel_uname": "",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff authored against read-only sys/ tree; kernel not rebuilt (Info-grade finding).",
 "fix_evidence": [
  "fix.diff"
 ]
}